* Thu Jul 09 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-135

- Update mta_filetrans_named_content() interface to cover more db files. - Revert "Remove ftpd_use_passive_mode boolean. It does not make sense due to ephemeral port handling." - Allow pcp domains to connect to own process using unix_stream_socket. - Typo in abrt.te - Allow abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly. - Add nagios_domtrans_unconfined_plugins() interface. - Add nagios_domtrans_unconfined_plugins() interface. - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob. - Add support for oddjob based helper in FreeIPA. BZ(1238165) - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/ BZ(1240840) - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. BZ(1224879) - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission. - Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires "entrypoint" permissios on nfs_t, cifs_t and fusefs_t SELinux types. - nrpe needs kill capability to make gluster moniterd nodes working. - Revert "Dontaudit ctbd_t sending signull to smbd_t." - Fix interface corenet_tcp_connect_postgresql_port_port(prosody_t) - Allow prosody connect to postgresql port. - Fix logging_syslogd_run_nagios_plugins calling in logging.te - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins. - Add support for oddjob based helper in FreeIPA. BZ(1238165) - Add new interfaces - Add fs_fusefs_entry_type() interface.
2015-07-09 10:31:45 +02:00 · 2015-07-09 10:31:45 +02:00 · f53ebea7af
commit f53ebea7af
parent d04212cd26
3 changed files with 406 additions and 226 deletions
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@ -35708,10 +35708,10 @@ index 4e94884..7ab6191 100644
 +	filetrans_pattern($1, syslogd_var_run_t, $2, $3, $4)
 +')
 diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 59b04c1..aaf4124 100644
+index 59b04c1..0bdf67e 100644
 --- a/policy/modules/system/logging.te
 +++ b/policy/modules/system/logging.te
-@@ -4,6 +4,21 @@ policy_module(logging, 1.20.1)
+@@ -4,6 +4,29 @@ policy_module(logging, 1.20.1)
 #
 # Declarations
 #
@ -35730,10 +35730,18 @@ index 59b04c1..aaf4124 100644
 +## </p>
 +## </desc>
 +gen_tunable(logging_syslogd_use_tty, true)
 +
 +## <desc>
 +## <p>
 +## Allow syslogd the ability to call nagios plugins. It is
 +## turned on by omprog rsyslog plugin.
 +## </p>
 +## </desc>
 +gen_tunable(logging_syslogd_run_nagios_plugins, false)
 attribute logfile;
-@@ -20,6 +35,7 @@ files_security_file(auditd_log_t)
+@@ -20,6 +43,7 @@ files_security_file(auditd_log_t)
 files_security_mountpoint(auditd_log_t)
 type audit_spool_t;
@ -35741,7 +35749,7 @@ index 59b04c1..aaf4124 100644
 files_security_file(audit_spool_t)
 files_security_mountpoint(audit_spool_t)
-@@ -33,6 +49,9 @@ init_script_file(auditd_initrc_exec_t)
+@@ -33,6 +57,9 @@ init_script_file(auditd_initrc_exec_t)
 type auditd_var_run_t;
 files_pid_file(auditd_var_run_t)
@ -35751,7 +35759,7 @@ index 59b04c1..aaf4124 100644
 type audisp_t;
 type audisp_exec_t;
 init_system_domain(audisp_t, audisp_exec_t)
-@@ -64,6 +83,7 @@ files_config_file(syslog_conf_t)
+@@ -64,6 +91,7 @@ files_config_file(syslog_conf_t)
 type syslogd_t;
 type syslogd_exec_t;
 init_daemon_domain(syslogd_t, syslogd_exec_t)
@ -35759,7 +35767,7 @@ index 59b04c1..aaf4124 100644
 type syslogd_initrc_exec_t;
 init_script_file(syslogd_initrc_exec_t)
-@@ -71,11 +91,15 @@ init_script_file(syslogd_initrc_exec_t)
+@@ -71,11 +99,15 @@ init_script_file(syslogd_initrc_exec_t)
 type syslogd_tmp_t;
 files_tmp_file(syslogd_tmp_t)
@ -35775,7 +35783,7 @@ index 59b04c1..aaf4124 100644
 type var_log_t;
 logging_log_file(var_log_t)
-@@ -94,6 +118,8 @@ ifdef(`enable_mls',`
+@@ -94,6 +126,8 @@ ifdef(`enable_mls',`
 allow auditctl_t self:capability { fsetid dac_read_search dac_override };
 allow auditctl_t self:netlink_audit_socket nlmsg_readpriv;
@ -35784,7 +35792,7 @@ index 59b04c1..aaf4124 100644
 read_files_pattern(auditctl_t, auditd_etc_t, auditd_etc_t)
 allow auditctl_t auditd_etc_t:dir list_dir_perms;
-@@ -111,7 +137,9 @@ domain_use_interactive_fds(auditctl_t)
+@@ -111,7 +145,9 @@ domain_use_interactive_fds(auditctl_t)
 mls_file_read_all_levels(auditctl_t)
@ -35795,7 +35803,7 @@ index 59b04c1..aaf4124 100644
 init_dontaudit_use_fds(auditctl_t)
-@@ -136,9 +164,10 @@ allow auditd_t self:tcp_socket create_stream_socket_perms;
+@@ -136,9 +172,10 @@ allow auditd_t self:tcp_socket create_stream_socket_perms;
 allow auditd_t auditd_etc_t:dir list_dir_perms;
 allow auditd_t auditd_etc_t:file read_file_perms;
@ -35807,7 +35815,7 @@ index 59b04c1..aaf4124 100644
 manage_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
 manage_sock_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
-@@ -148,6 +177,7 @@ kernel_read_kernel_sysctls(auditd_t)
+@@ -148,6 +185,7 @@ kernel_read_kernel_sysctls(auditd_t)
 # Needs to be able to run dispatcher.  see /etc/audit/auditd.conf
 # Probably want a transition, and a new auditd_helper app
 kernel_read_system_state(auditd_t)
@ -35815,7 +35823,7 @@ index 59b04c1..aaf4124 100644
 dev_read_sysfs(auditd_t)
-@@ -155,9 +185,6 @@ fs_getattr_all_fs(auditd_t)
+@@ -155,9 +193,6 @@ fs_getattr_all_fs(auditd_t)
 fs_search_auto_mountpoints(auditd_t)
 fs_rw_anon_inodefs_files(auditd_t)
@ -35825,7 +35833,7 @@ index 59b04c1..aaf4124 100644
 corenet_all_recvfrom_netlabel(auditd_t)
 corenet_tcp_sendrecv_generic_if(auditd_t)
 corenet_tcp_sendrecv_generic_node(auditd_t)
-@@ -183,16 +210,17 @@ logging_send_syslog_msg(auditd_t)
+@@ -183,16 +218,17 @@ logging_send_syslog_msg(auditd_t)
 logging_domtrans_dispatcher(auditd_t)
 logging_signal_dispatcher(auditd_t)
@ -35847,7 +35855,7 @@ index 59b04c1..aaf4124 100644
 userdom_dontaudit_use_unpriv_user_fds(auditd_t)
 userdom_dontaudit_search_user_home_dirs(auditd_t)
-@@ -237,19 +265,29 @@ corecmd_exec_shell(audisp_t)
+@@ -237,19 +273,29 @@ corecmd_exec_shell(audisp_t)
 domain_use_interactive_fds(audisp_t)
@ -35879,7 +35887,7 @@ index 59b04c1..aaf4124 100644
 ')
 ########################################
-@@ -268,7 +306,6 @@ files_spool_filetrans(audisp_remote_t, audit_spool_t, { dir file })
+@@ -268,7 +314,6 @@ files_spool_filetrans(audisp_remote_t, audit_spool_t, { dir file })
 corecmd_exec_bin(audisp_remote_t)
@ -35887,7 +35895,7 @@ index 59b04c1..aaf4124 100644
 corenet_all_recvfrom_netlabel(audisp_remote_t)
 corenet_tcp_sendrecv_generic_if(audisp_remote_t)
 corenet_tcp_sendrecv_generic_node(audisp_remote_t)
-@@ -280,10 +317,18 @@ corenet_sendrecv_audit_client_packets(audisp_remote_t)
+@@ -280,10 +325,18 @@ corenet_sendrecv_audit_client_packets(audisp_remote_t)
 files_read_etc_files(audisp_remote_t)
@ -35907,7 +35915,7 @@ index 59b04c1..aaf4124 100644
 sysnet_dns_name_resolve(audisp_remote_t)
-@@ -326,7 +371,6 @@ files_read_etc_files(klogd_t)
+@@ -326,7 +379,6 @@ files_read_etc_files(klogd_t)
 logging_send_syslog_msg(klogd_t)
@ -35915,7 +35923,7 @@ index 59b04c1..aaf4124 100644
 mls_file_read_all_levels(klogd_t)
-@@ -355,13 +399,12 @@ optional_policy(`
+@@ -355,13 +407,12 @@ optional_policy(`
 # sys_admin for the integrated klog of syslog-ng and metalog
 # sys_nice for rsyslog
 # cjp: why net_admin!
@ -35932,7 +35940,7 @@ index 59b04c1..aaf4124 100644
 # receive messages to be logged
 allow syslogd_t self:unix_dgram_socket create_socket_perms;
 allow syslogd_t self:unix_stream_socket create_stream_socket_perms;
-@@ -369,11 +412,15 @@ allow syslogd_t self:unix_dgram_socket sendto;
+@@ -369,11 +420,15 @@ allow syslogd_t self:unix_dgram_socket sendto;
 allow syslogd_t self:fifo_file rw_fifo_file_perms;
 allow syslogd_t self:udp_socket create_socket_perms;
 allow syslogd_t self:tcp_socket create_stream_socket_perms;
@ -35949,7 +35957,7 @@ index 59b04c1..aaf4124 100644
 files_pid_filetrans(syslogd_t, devlog_t, sock_file)
 # create/append log files.
-@@ -389,30 +436,47 @@ manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
+@@ -389,30 +444,47 @@ manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
 manage_files_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
 files_tmp_filetrans(syslogd_t, syslogd_tmp_t, { dir file })
@ -36000,7 +36008,7 @@ index 59b04c1..aaf4124 100644
 # syslog-ng can listen and connect on tcp port 514 (rsh)
 corenet_tcp_sendrecv_generic_if(syslogd_t)
 corenet_tcp_sendrecv_generic_node(syslogd_t)
-@@ -422,6 +486,8 @@ corenet_tcp_bind_rsh_port(syslogd_t)
+@@ -422,6 +494,8 @@ corenet_tcp_bind_rsh_port(syslogd_t)
 corenet_tcp_connect_rsh_port(syslogd_t)
 # Allow users to define additional syslog ports to connect to
 corenet_tcp_bind_syslogd_port(syslogd_t)
@ -36009,7 +36017,7 @@ index 59b04c1..aaf4124 100644
 corenet_tcp_connect_syslogd_port(syslogd_t)
 corenet_tcp_connect_postgresql_port(syslogd_t)
 corenet_tcp_connect_mysqld_port(syslogd_t)
-@@ -432,9 +498,26 @@ corenet_sendrecv_syslogd_server_packets(syslogd_t)
+@@ -432,9 +506,32 @@ corenet_sendrecv_syslogd_server_packets(syslogd_t)
 corenet_sendrecv_postgresql_client_packets(syslogd_t)
 corenet_sendrecv_mysqld_client_packets(syslogd_t)
@ -36022,6 +36030,12 @@ index 59b04c1..aaf4124 100644
 +	# support for ommail module to send logs via mail
 +	corenet_tcp_connect_smtp_port(syslogd_t)
 +')
 +
 +optional_policy(`
 +    tunable_policy(`logging_syslogd_run_nagios_plugins',`
 +        nagios_domtrans_unconfined_plugins(syslogd_t)
 +    ')
 +')
 +
 dev_filetrans(syslogd_t, devlog_t, sock_file)
 dev_read_sysfs(syslogd_t)
@ -36037,7 +36051,7 @@ index 59b04c1..aaf4124 100644
 domain_use_interactive_fds(syslogd_t)
 files_read_etc_files(syslogd_t)
-@@ -448,13 +531,17 @@ files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir })
+@@ -448,13 +545,17 @@ files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir })
 fs_getattr_all_fs(syslogd_t)
 fs_search_auto_mountpoints(syslogd_t)
@ -36055,7 +36069,7 @@ index 59b04c1..aaf4124 100644
 # for sending messages to logged in users
 init_read_utmp(syslogd_t)
 init_dontaudit_write_utmp(syslogd_t)
-@@ -466,11 +553,12 @@ init_use_fds(syslogd_t)
+@@ -466,11 +567,12 @@ init_use_fds(syslogd_t)
 # cjp: this doesnt make sense
 logging_send_syslog_msg(syslogd_t)
@ -36071,7 +36085,7 @@ index 59b04c1..aaf4124 100644
 ifdef(`distro_gentoo',`
 	# default gentoo syslog-ng config appends kernel
-@@ -497,6 +585,7 @@ optional_policy(`
+@@ -497,6 +599,7 @@ optional_policy(`
 optional_policy(`
 	cron_manage_log_files(syslogd_t)
 	cron_generic_log_filetrans_log(syslogd_t, file, "cron.log")
@ -36079,7 +36093,7 @@ index 59b04c1..aaf4124 100644
 ')
 optional_policy(`
-@@ -507,15 +596,40 @@ optional_policy(`
+@@ -507,15 +610,40 @@ optional_policy(`
 ')
 optional_policy(`
@ -36120,7 +36134,7 @@ index 59b04c1..aaf4124 100644
 ')
 optional_policy(`
-@@ -526,3 +640,26 @@ optional_policy(`
+@@ -526,3 +654,26 @@ optional_policy(`
 	# log to the xconsole
 	xserver_rw_console(syslogd_t)
 ')
@ -44854,7 +44868,7 @@ index db75976..c54480a 100644
 +/var/tmp/hsperfdata_root    gen_context(system_u:object_r:user_tmp_t,s0)
 +
 diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
-index 9dc60c6..769ce74 100644
+index 9dc60c6..a24e48e 100644
 --- a/policy/modules/system/userdomain.if
 +++ b/policy/modules/system/userdomain.if
@@ -30,9 +30,11 @@ template(`userdom_base_user_template',`
@ -45855,7 +45869,7 @@ index 9dc60c6..769ce74 100644
 	userdom_change_password_template($1)
-@@ -761,83 +1007,107 @@ template(`userdom_login_user_template', `
+@@ -761,82 +1007,109 @@ template(`userdom_login_user_template', `
 	#
 	# User domain Local policy
 	#
@ -45990,16 +46004,18 @@ index 9dc60c6..769ce74 100644
 +		oddjob_run_mkhomedir($1_t, $1_r)
 	')
 +    optional_policy(`
 +        ipa_run_helper($1_t, $1_r)
 +    ')
 +
 	optional_policy(`
 -		rpm_read_db($1_t)
 -		rpm_dontaudit_manage_db($1_t)
 +		wine_filetrans_named_content($1_usertype)
 	')
 +
 ')
- #######################################
+@@ -868,6 +1141,12 @@ template(`userdom_restricted_user_template',`
@@ -868,6 +1138,12 @@ template(`userdom_restricted_user_template',`
 	typeattribute $1_t unpriv_userdomain;
 	domain_interactive_fd($1_t)
@ -46012,7 +46028,7 @@ index 9dc60c6..769ce74 100644
 	##############################
 	#
 	# Local policy
-@@ -907,53 +1183,137 @@ template(`userdom_restricted_xwindows_user_template',`
+@@ -907,53 +1186,137 @@ template(`userdom_restricted_xwindows_user_template',`
 	#
 	# Local policy
 	#
@ -46168,7 +46184,7 @@ index 9dc60c6..769ce74 100644
 ')
 #######################################
-@@ -987,27 +1347,33 @@ template(`userdom_unpriv_user_template', `
+@@ -987,27 +1350,33 @@ template(`userdom_unpriv_user_template', `
 	#
 	# Inherit rules for ordinary users.
@ -46206,7 +46222,7 @@ index 9dc60c6..769ce74 100644
 			fs_manage_noxattr_fs_files($1_t)
 			fs_manage_noxattr_fs_dirs($1_t)
 			# Write floppies
-@@ -1018,23 +1384,63 @@ template(`userdom_unpriv_user_template', `
+@@ -1018,23 +1387,63 @@ template(`userdom_unpriv_user_template', `
 		')
 	')
@ -46280,7 +46296,7 @@ index 9dc60c6..769ce74 100644
 	')
 	# Run pppd in pppd_t by default for user
-@@ -1043,7 +1449,9 @@ template(`userdom_unpriv_user_template', `
+@@ -1043,7 +1452,9 @@ template(`userdom_unpriv_user_template', `
 	')
 	optional_policy(`
@ -46291,7 +46307,7 @@ index 9dc60c6..769ce74 100644
 	')
 ')
-@@ -1079,7 +1487,9 @@ template(`userdom_unpriv_user_template', `
+@@ -1079,7 +1490,9 @@ template(`userdom_unpriv_user_template', `
 template(`userdom_admin_user_template',`
 	gen_require(`
 		attribute admindomain;
@ -46302,7 +46318,7 @@ index 9dc60c6..769ce74 100644
 	')
 	##############################
-@@ -1095,6 +1505,7 @@ template(`userdom_admin_user_template',`
+@@ -1095,6 +1508,7 @@ template(`userdom_admin_user_template',`
 	role system_r types $1_t;
 	typeattribute $1_t admindomain;
@ -46310,7 +46326,7 @@ index 9dc60c6..769ce74 100644
 	ifdef(`direct_sysadm_daemon',`
 		domain_system_change_exemption($1_t)
-@@ -1105,14 +1516,8 @@ template(`userdom_admin_user_template',`
+@@ -1105,14 +1519,8 @@ template(`userdom_admin_user_template',`
 	# $1_t local policy
 	#
@ -46327,7 +46343,7 @@ index 9dc60c6..769ce74 100644
 	kernel_read_software_raid_state($1_t)
 	kernel_getattr_core_if($1_t)
-@@ -1128,6 +1533,7 @@ template(`userdom_admin_user_template',`
+@@ -1128,6 +1536,7 @@ template(`userdom_admin_user_template',`
 	kernel_sigstop_unlabeled($1_t)
 	kernel_signull_unlabeled($1_t)
 	kernel_sigchld_unlabeled($1_t)
@ -46335,7 +46351,7 @@ index 9dc60c6..769ce74 100644
 	corenet_tcp_bind_generic_port($1_t)
 	# allow setting up tunnels
-@@ -1145,10 +1551,15 @@ template(`userdom_admin_user_template',`
+@@ -1145,10 +1554,15 @@ template(`userdom_admin_user_template',`
 	dev_rename_all_blk_files($1_t)
 	dev_rename_all_chr_files($1_t)
 	dev_create_generic_symlinks($1_t)
@ -46351,7 +46367,7 @@ index 9dc60c6..769ce74 100644
 	domain_dontaudit_ptrace_all_domains($1_t)
 	# signal all domains:
 	domain_kill_all_domains($1_t)
-@@ -1159,29 +1570,40 @@ template(`userdom_admin_user_template',`
+@@ -1159,29 +1573,40 @@ template(`userdom_admin_user_template',`
 	domain_sigchld_all_domains($1_t)
 	# for lsof
 	domain_getattr_all_sockets($1_t)
@ -46396,7 +46412,7 @@ index 9dc60c6..769ce74 100644
 	# The following rule is temporary until such time that a complete
 	# policy management infrastructure is in place so that an administrator
-@@ -1191,6 +1613,8 @@ template(`userdom_admin_user_template',`
+@@ -1191,6 +1616,8 @@ template(`userdom_admin_user_template',`
 	# But presently necessary for installing the file_contexts file.
 	seutil_manage_bin_policy($1_t)
@ -46405,7 +46421,7 @@ index 9dc60c6..769ce74 100644
 	userdom_manage_user_home_content_dirs($1_t)
 	userdom_manage_user_home_content_files($1_t)
 	userdom_manage_user_home_content_symlinks($1_t)
-@@ -1198,13 +1622,21 @@ template(`userdom_admin_user_template',`
+@@ -1198,13 +1625,21 @@ template(`userdom_admin_user_template',`
 	userdom_manage_user_home_content_sockets($1_t)
 	userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
@ -46428,7 +46444,7 @@ index 9dc60c6..769ce74 100644
 	optional_policy(`
 		postgresql_unconfined($1_t)
 	')
-@@ -1240,7 +1672,7 @@ template(`userdom_admin_user_template',`
+@@ -1240,7 +1675,7 @@ template(`userdom_admin_user_template',`
 ##	</summary>
 ## </param>
 #
@ -46437,7 +46453,7 @@ index 9dc60c6..769ce74 100644
 	allow $1 self:capability { dac_read_search dac_override };
 	corecmd_exec_shell($1)
-@@ -1250,6 +1682,8 @@ template(`userdom_security_admin_template',`
+@@ -1250,6 +1685,8 @@ template(`userdom_security_admin_template',`
 	dev_relabel_all_dev_nodes($1)
 	files_create_boot_flag($1)
@ -46446,7 +46462,7 @@ index 9dc60c6..769ce74 100644
 	# Necessary for managing /boot/efi
 	fs_manage_dos_files($1)
-@@ -1262,8 +1696,10 @@ template(`userdom_security_admin_template',`
+@@ -1262,8 +1699,10 @@ template(`userdom_security_admin_template',`
 	selinux_set_enforce_mode($1)
 	selinux_set_all_booleans($1)
 	selinux_set_parameters($1)
@ -46458,7 +46474,7 @@ index 9dc60c6..769ce74 100644
 	auth_relabel_shadow($1)
 	init_exec($1)
-@@ -1274,29 +1710,31 @@ template(`userdom_security_admin_template',`
+@@ -1274,29 +1713,31 @@ template(`userdom_security_admin_template',`
 	logging_read_audit_config($1)
 	seutil_manage_bin_policy($1)
@ -46501,7 +46517,7 @@ index 9dc60c6..769ce74 100644
 	')
 	optional_policy(`
-@@ -1357,14 +1795,17 @@ interface(`userdom_user_home_content',`
+@@ -1357,14 +1798,17 @@ interface(`userdom_user_home_content',`
 	gen_require(`
 		attribute user_home_content_type;
 		type user_home_t;
@ -46520,7 +46536,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -1397,12 +1838,51 @@ interface(`userdom_user_tmp_file',`
+@@ -1397,12 +1841,51 @@ interface(`userdom_user_tmp_file',`
 ## </param>
 #
 interface(`userdom_user_tmpfs_file',`
@ -46573,7 +46589,7 @@ index 9dc60c6..769ce74 100644
 ##	Allow domain to attach to TUN devices created by administrative users.
 ## </summary>
 ## <param name="domain">
-@@ -1509,11 +1989,31 @@ interface(`userdom_search_user_home_dirs',`
+@@ -1509,11 +1992,31 @@ interface(`userdom_search_user_home_dirs',`
 	')
 	allow $1 user_home_dir_t:dir search_dir_perms;
@ -46605,7 +46621,7 @@ index 9dc60c6..769ce74 100644
 ##	Do not audit attempts to search user home directories.
 ## </summary>
 ## <desc>
-@@ -1555,6 +2055,14 @@ interface(`userdom_list_user_home_dirs',`
+@@ -1555,6 +2058,14 @@ interface(`userdom_list_user_home_dirs',`
 	allow $1 user_home_dir_t:dir list_dir_perms;
 	files_search_home($1)
@ -46620,7 +46636,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -1570,9 +2078,11 @@ interface(`userdom_list_user_home_dirs',`
+@@ -1570,9 +2081,11 @@ interface(`userdom_list_user_home_dirs',`
 interface(`userdom_dontaudit_list_user_home_dirs',`
 	gen_require(`
 		type user_home_dir_t;
@ -46632,7 +46648,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -1613,6 +2123,24 @@ interface(`userdom_manage_user_home_dirs',`
+@@ -1613,6 +2126,24 @@ interface(`userdom_manage_user_home_dirs',`
 ########################################
 ## <summary>
@ -46657,7 +46673,7 @@ index 9dc60c6..769ce74 100644
 ##	Relabel to user home directories.
 ## </summary>
 ## <param name="domain">
-@@ -1631,6 +2159,59 @@ interface(`userdom_relabelto_user_home_dirs',`
+@@ -1631,6 +2162,59 @@ interface(`userdom_relabelto_user_home_dirs',`
 ########################################
 ## <summary>
@ -46717,7 +46733,7 @@ index 9dc60c6..769ce74 100644
 ##	Create directories in the home dir root with
 ##	the user home directory type.
 ## </summary>
-@@ -1704,10 +2285,12 @@ interface(`userdom_user_home_domtrans',`
+@@ -1704,10 +2288,12 @@ interface(`userdom_user_home_domtrans',`
 #
 interface(`userdom_dontaudit_search_user_home_content',`
 	gen_require(`
@ -46732,7 +46748,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -1741,10 +2324,12 @@ interface(`userdom_list_all_user_home_content',`
+@@ -1741,10 +2327,12 @@ interface(`userdom_list_all_user_home_content',`
 #
 interface(`userdom_list_user_home_content',`
 	gen_require(`
@ -46747,7 +46763,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -1769,7 +2354,7 @@ interface(`userdom_manage_user_home_content_dirs',`
+@@ -1769,7 +2357,7 @@ interface(`userdom_manage_user_home_content_dirs',`
 ########################################
 ## <summary>
@ -46756,7 +46772,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -1777,19 +2362,17 @@ interface(`userdom_manage_user_home_content_dirs',`
+@@ -1777,19 +2365,17 @@ interface(`userdom_manage_user_home_content_dirs',`
 ##	</summary>
 ## </param>
 #
@ -46780,7 +46796,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -1797,55 +2380,55 @@ interface(`userdom_delete_all_user_home_content_dirs',`
+@@ -1797,55 +2383,55 @@ interface(`userdom_delete_all_user_home_content_dirs',`
 ##	</summary>
 ## </param>
 #
@ -46851,7 +46867,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -1853,18 +2436,19 @@ interface(`userdom_dontaudit_setattr_user_home_content_files',`
+@@ -1853,18 +2439,19 @@ interface(`userdom_dontaudit_setattr_user_home_content_files',`
 ##	</summary>
 ## </param>
 #
@ -46879,7 +46895,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -1872,17 +2456,151 @@ interface(`userdom_mmap_user_home_content_files',`
+@@ -1872,17 +2459,151 @@ interface(`userdom_mmap_user_home_content_files',`
 ##	</summary>
 ## </param>
 #
@ -47035,7 +47051,7 @@ index 9dc60c6..769ce74 100644
 ##	Do not audit attempts to read user home files.
 ## </summary>
 ## <param name="domain">
-@@ -1893,11 +2611,14 @@ interface(`userdom_read_user_home_content_files',`
+@@ -1893,11 +2614,14 @@ interface(`userdom_read_user_home_content_files',`
 #
 interface(`userdom_dontaudit_read_user_home_content_files',`
 	gen_require(`
@ -47053,7 +47069,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -1938,7 +2659,7 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
+@@ -1938,7 +2662,7 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
 ########################################
 ## <summary>
@ -47062,7 +47078,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -1946,10 +2667,9 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
+@@ -1946,10 +2670,9 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
 ##	</summary>
 ## </param>
 #
@ -47075,7 +47091,7 @@ index 9dc60c6..769ce74 100644
 	')
 	userdom_search_user_home_content($1)
-@@ -1958,7 +2678,7 @@ interface(`userdom_delete_all_user_home_content_files',`
+@@ -1958,7 +2681,7 @@ interface(`userdom_delete_all_user_home_content_files',`
 ########################################
 ## <summary>
@ -47084,7 +47100,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -1966,12 +2686,66 @@ interface(`userdom_delete_all_user_home_content_files',`
+@@ -1966,12 +2689,66 @@ interface(`userdom_delete_all_user_home_content_files',`
 ##	</summary>
 ## </param>
 #
@ -47153,7 +47169,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -2007,8 +2781,7 @@ interface(`userdom_read_user_home_content_symlinks',`
+@@ -2007,8 +2784,7 @@ interface(`userdom_read_user_home_content_symlinks',`
 		type user_home_dir_t, user_home_t;
 	')
@ -47163,7 +47179,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -2024,20 +2797,14 @@ interface(`userdom_read_user_home_content_symlinks',`
+@@ -2024,20 +2800,14 @@ interface(`userdom_read_user_home_content_symlinks',`
 #
 interface(`userdom_exec_user_home_content_files',`
 	gen_require(`
@ -47188,7 +47204,7 @@ index 9dc60c6..769ce74 100644
 ########################################
 ## <summary>
-@@ -2120,7 +2887,7 @@ interface(`userdom_manage_user_home_content_symlinks',`
+@@ -2120,7 +2890,7 @@ interface(`userdom_manage_user_home_content_symlinks',`
 ########################################
 ## <summary>
@ -47197,7 +47213,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -2128,19 +2895,17 @@ interface(`userdom_manage_user_home_content_symlinks',`
+@@ -2128,19 +2898,17 @@ interface(`userdom_manage_user_home_content_symlinks',`
 ##	</summary>
 ## </param>
 #
@ -47221,7 +47237,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -2148,12 +2913,12 @@ interface(`userdom_delete_all_user_home_content_symlinks',`
+@@ -2148,12 +2916,12 @@ interface(`userdom_delete_all_user_home_content_symlinks',`
 ##	</summary>
 ## </param>
 #
@ -47237,7 +47253,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -2388,18 +3153,54 @@ interface(`userdom_dontaudit_manage_user_tmp_dirs',`
+@@ -2388,18 +3156,54 @@ interface(`userdom_dontaudit_manage_user_tmp_dirs',`
 ##	</summary>
 ## </param>
 #
@ -47295,7 +47311,7 @@ index 9dc60c6..769ce74 100644
 ##	Do not audit attempts to read users
 ##	temporary files.
 ## </summary>
-@@ -2414,7 +3215,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
+@@ -2414,7 +3218,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
 		type user_tmp_t;
 	')
@ -47304,7 +47320,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -2455,6 +3256,25 @@ interface(`userdom_rw_user_tmp_files',`
+@@ -2455,6 +3259,25 @@ interface(`userdom_rw_user_tmp_files',`
 	rw_files_pattern($1, user_tmp_t, user_tmp_t)
 	files_search_tmp($1)
 ')
@ -47330,7 +47346,7 @@ index 9dc60c6..769ce74 100644
 ########################################
 ## <summary>
-@@ -2538,7 +3358,7 @@ interface(`userdom_manage_user_tmp_files',`
+@@ -2538,7 +3361,7 @@ interface(`userdom_manage_user_tmp_files',`
 ########################################
 ## <summary>
 ##	Create, read, write, and delete user
@ -47339,7 +47355,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -2546,19 +3366,19 @@ interface(`userdom_manage_user_tmp_files',`
+@@ -2546,19 +3369,19 @@ interface(`userdom_manage_user_tmp_files',`
 ##	</summary>
 ## </param>
 #
@ -47362,7 +47378,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -2566,19 +3386,19 @@ interface(`userdom_manage_user_tmp_symlinks',`
+@@ -2566,19 +3389,19 @@ interface(`userdom_manage_user_tmp_symlinks',`
 ##	</summary>
 ## </param>
 #
@ -47385,7 +47401,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -2586,19 +3406,60 @@ interface(`userdom_manage_user_tmp_pipes',`
+@@ -2586,19 +3409,60 @@ interface(`userdom_manage_user_tmp_pipes',`
 ##	</summary>
 ## </param>
 #
@ -47450,7 +47466,7 @@ index 9dc60c6..769ce74 100644
 ##	a specified private type.
 ## </summary>
 ## <param name="domain">
-@@ -2661,6 +3522,21 @@ interface(`userdom_tmp_filetrans_user_tmp',`
+@@ -2661,6 +3525,21 @@ interface(`userdom_tmp_filetrans_user_tmp',`
 	files_tmp_filetrans($1, user_tmp_t, $2, $3)
 ')
@ -47472,7 +47488,7 @@ index 9dc60c6..769ce74 100644
 ########################################
 ## <summary>
 ##	Read user tmpfs files.
-@@ -2672,18 +3548,13 @@ interface(`userdom_tmp_filetrans_user_tmp',`
+@@ -2672,18 +3551,13 @@ interface(`userdom_tmp_filetrans_user_tmp',`
 ## </param>
 #
 interface(`userdom_read_user_tmpfs_files',`
@ -47494,7 +47510,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -2692,19 +3563,13 @@ interface(`userdom_read_user_tmpfs_files',`
+@@ -2692,19 +3566,13 @@ interface(`userdom_read_user_tmpfs_files',`
 ## </param>
 #
 interface(`userdom_rw_user_tmpfs_files',`
@ -47517,7 +47533,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -2713,13 +3578,56 @@ interface(`userdom_rw_user_tmpfs_files',`
+@@ -2713,13 +3581,56 @@ interface(`userdom_rw_user_tmpfs_files',`
 ## </param>
 #
 interface(`userdom_manage_user_tmpfs_files',`
@ -47578,7 +47594,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -2814,6 +3722,24 @@ interface(`userdom_use_user_ttys',`
+@@ -2814,6 +3725,24 @@ interface(`userdom_use_user_ttys',`
 ########################################
 ## <summary>
@ -47603,7 +47619,7 @@ index 9dc60c6..769ce74 100644
 ##	Read and write a user domain pty.
 ## </summary>
 ## <param name="domain">
-@@ -2832,22 +3758,34 @@ interface(`userdom_use_user_ptys',`
+@@ -2832,22 +3761,34 @@ interface(`userdom_use_user_ptys',`
 ########################################
 ## <summary>
@ -47646,7 +47662,7 @@ index 9dc60c6..769ce74 100644
 ## </desc>
 ## <param name="domain">
 ##	<summary>
-@@ -2856,14 +3794,33 @@ interface(`userdom_use_user_ptys',`
+@@ -2856,14 +3797,33 @@ interface(`userdom_use_user_ptys',`
 ## </param>
 ## <infoflow type="both" weight="10"/>
 #
@ -47684,7 +47700,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -2882,8 +3839,27 @@ interface(`userdom_dontaudit_use_user_terminals',`
+@@ -2882,8 +3842,27 @@ interface(`userdom_dontaudit_use_user_terminals',`
 		type user_tty_device_t, user_devpts_t;
 	')
@ -47714,7 +47730,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -2955,69 +3931,68 @@ interface(`userdom_spec_domtrans_unpriv_users',`
+@@ -2955,69 +3934,68 @@ interface(`userdom_spec_domtrans_unpriv_users',`
 	allow unpriv_userdomain $1:process sigchld;
 ')
@ -47815,7 +47831,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -3025,12 +4000,12 @@ interface(`userdom_manage_unpriv_user_semaphores',`
+@@ -3025,12 +4003,12 @@ interface(`userdom_manage_unpriv_user_semaphores',`
 ##	</summary>
 ## </param>
 #
@ -47830,7 +47846,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -3094,7 +4069,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
+@@ -3094,7 +4072,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
 	domain_entry_file_spec_domtrans($1, unpriv_userdomain)
 	allow unpriv_userdomain $1:fd use;
@ -47839,7 +47855,7 @@ index 9dc60c6..769ce74 100644
 	allow unpriv_userdomain $1:process sigchld;
 ')
-@@ -3110,29 +4085,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
+@@ -3110,29 +4088,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
 #
 interface(`userdom_search_user_home_content',`
 	gen_require(`
@ -47873,7 +47889,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -3214,7 +4173,25 @@ interface(`userdom_dontaudit_use_user_ptys',`
+@@ -3214,7 +4176,25 @@ interface(`userdom_dontaudit_use_user_ptys',`
 		type user_devpts_t;
 	')
@ -47900,7 +47916,7 @@ index 9dc60c6..769ce74 100644
 ')
 ########################################
-@@ -3269,12 +4246,13 @@ interface(`userdom_write_user_tmp_files',`
+@@ -3269,12 +4249,13 @@ interface(`userdom_write_user_tmp_files',`
 		type user_tmp_t;
 	')
@ -47916,7 +47932,7 @@ index 9dc60c6..769ce74 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -3282,46 +4260,122 @@ interface(`userdom_write_user_tmp_files',`
+@@ -3282,46 +4263,122 @@ interface(`userdom_write_user_tmp_files',`
 ##	</summary>
 ## </param>
 #
@ -48052,7 +48068,7 @@ index 9dc60c6..769ce74 100644
 	')
 	allow $1 userdomain:process getattr;
-@@ -3382,6 +4436,42 @@ interface(`userdom_signal_all_users',`
+@@ -3382,6 +4439,42 @@ interface(`userdom_signal_all_users',`
 	allow $1 userdomain:process signal;
 ')
@ -48095,7 +48111,7 @@ index 9dc60c6..769ce74 100644
 ########################################
 ## <summary>
 ##	Send a SIGCHLD signal to all user domains.
-@@ -3402,6 +4492,60 @@ interface(`userdom_sigchld_all_users',`
+@@ -3402,6 +4495,60 @@ interface(`userdom_sigchld_all_users',`
 ########################################
 ## <summary>
@ -48156,7 +48172,7 @@ index 9dc60c6..769ce74 100644
 ##	Create keys for all user domains.
 ## </summary>
 ## <param name="domain">
-@@ -3435,4 +4579,1691 @@ interface(`userdom_dbus_send_all_users',`
+@@ -3435,4 +4582,1691 @@ interface(`userdom_dbus_send_all_users',`
 	')
 	allow $1 userdomain:dbus send_msg;
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@ -546,7 +546,7 @@ index 058d908..158acba 100644
 +')
 +
 diff --git a/abrt.te b/abrt.te
-index eb50f07..a0f044b 100644
+index eb50f07..d6d0e34 100644
 --- a/abrt.te
 +++ b/abrt.te
@@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1)
@ -1054,7 +1054,7 @@ index eb50f07..a0f044b 100644
 #######################################
 #
-@@ -404,25 +517,58 @@ logging_read_generic_logs(abrt_dump_oops_t)
+@@ -404,25 +517,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
 #
 allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms;
@ -1086,7 +1086,7 @@ index eb50f07..a0f044b 100644
 # Upload watch local policy
 #
-+allow abrt_upload_watch_t self:capability { dac_override chown };
+allow abrt_upload_watch_t self:capability { dac_override chown fsetid };
 +
 +manage_files_pattern(abrt_upload_watch_t, abrt_upload_watch_tmp_t, abrt_upload_watch_tmp_t)
 +manage_dirs_pattern(abrt_upload_watch_t, abrt_upload_watch_tmp_t, abrt_upload_watch_tmp_t)
@ -1096,6 +1096,8 @@ index eb50f07..a0f044b 100644
 +read_files_pattern(abrt_upload_watch_t, abrt_etc_t, abrt_etc_t)
 +
 +manage_dirs_pattern(abrt_upload_watch_t, abrt_var_cache_t, abrt_var_cache_t)
 +
 +abrt_dbus_chat(abrt_upload_watch_t)
 +
 corecmd_exec_bin(abrt_upload_watch_t)
@ -1115,7 +1117,7 @@ index eb50f07..a0f044b 100644
 ')
 #######################################
-@@ -430,10 +576,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
+@@ -430,10 +578,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
 # Global local policy
 #
@ -5173,10 +5175,10 @@ index f6eb485..164501c 100644
 +	filetrans_pattern($1, { httpd_user_content_t httpd_user_script_exec_t }, httpd_user_htaccess_t, file, ".htaccess")
 ')
 diff --git a/apache.te b/apache.te
-index 6649962..44258d7 100644
+index 6649962..fc23c8a 100644
 --- a/apache.te
 +++ b/apache.te
-@@ -5,280 +5,339 @@ policy_module(apache, 2.7.2)
+@@ -5,280 +5,346 @@ policy_module(apache, 2.7.2)
 # Declarations
 #
@ -5251,6 +5253,13 @@ index 6649962..44258d7 100644
 +
 +## <desc>
 +## <p>
 +## Allow httpd processes to run IPA helper.
 +## </p>
 +## </desc>
 +gen_tunable(httpd_run_ipa, false)
 +
 +## <desc>
 +## <p>
 +## Allow httpd to use built in scripting (usually php)
 +## </p>
 +## </desc>
@ -5305,23 +5314,23 @@ index 6649962..44258d7 100644
 -##	</p>
 +## <p>
 +## Allow HTTPD scripts and modules to connect to databases over the network.
 +## </p>
 +## </desc>
 +gen_tunable(httpd_can_network_connect_db, false)
 +
 +## <desc>
 +## <p>
 +## Allow httpd to connect to memcache server
 +## </p>
 ## </desc>
 -gen_tunable(httpd_can_network_connect_memcache, false)
-+gen_tunable(httpd_can_network_connect_db, false)
+gen_tunable(httpd_can_network_memcache, false)
 ## <desc>
 -##	<p>
 -##	Determine whether httpd can act as a relay.
 -##	</p>
 +## <p>
 +## Allow httpd to connect to memcache server
 +## </p>
 +## </desc>
 +gen_tunable(httpd_can_network_memcache, false)
 +
 +## <desc>
 +## <p>
 +## Allow httpd to act as a relay
 +## </p>
 ## </desc>
@ -5662,7 +5671,7 @@ index 6649962..44258d7 100644
 type httpd_initrc_exec_t;
 init_script_file(httpd_initrc_exec_t)
-@@ -286,15 +345,35 @@ init_script_file(httpd_initrc_exec_t)
+@@ -286,15 +352,35 @@ init_script_file(httpd_initrc_exec_t)
 type httpd_keytab_t;
 files_type(httpd_keytab_t)
@ -5698,7 +5707,7 @@ index 6649962..44258d7 100644
 type httpd_rotatelogs_t;
 type httpd_rotatelogs_exec_t;
 init_daemon_domain(httpd_rotatelogs_t, httpd_rotatelogs_exec_t)
-@@ -302,10 +381,8 @@ init_daemon_domain(httpd_rotatelogs_t, httpd_rotatelogs_exec_t)
+@@ -302,10 +388,8 @@ init_daemon_domain(httpd_rotatelogs_t, httpd_rotatelogs_exec_t)
 type httpd_squirrelmail_t;
 files_type(httpd_squirrelmail_t)
@ -5711,7 +5720,7 @@ index 6649962..44258d7 100644
 type httpd_suexec_exec_t;
 domain_type(httpd_suexec_t)
 domain_entry_file(httpd_suexec_t, httpd_suexec_exec_t)
-@@ -314,9 +391,19 @@ role system_r types httpd_suexec_t;
+@@ -314,9 +398,19 @@ role system_r types httpd_suexec_t;
 type httpd_suexec_tmp_t;
 files_tmp_file(httpd_suexec_tmp_t)
@ -5734,7 +5743,7 @@ index 6649962..44258d7 100644
 type httpd_tmp_t;
 files_tmp_file(httpd_tmp_t)
-@@ -324,14 +411,21 @@ files_tmp_file(httpd_tmp_t)
+@@ -324,14 +418,21 @@ files_tmp_file(httpd_tmp_t)
 type httpd_tmpfs_t;
 files_tmpfs_file(httpd_tmpfs_t)
@ -5757,7 +5766,7 @@ index 6649962..44258d7 100644
 typealias httpd_user_content_t alias { httpd_auditadm_content_t httpd_secadm_content_t };
 typealias httpd_user_content_t alias { httpd_staff_script_ro_t httpd_sysadm_script_ro_t };
 typealias httpd_user_content_t alias { httpd_auditadm_script_ro_t httpd_secadm_script_ro_t };
-@@ -346,33 +440,40 @@ typealias httpd_user_rw_content_t alias { httpd_auditadm_script_rw_t httpd_secad
+@@ -346,33 +447,40 @@ typealias httpd_user_rw_content_t alias { httpd_auditadm_script_rw_t httpd_secad
 typealias httpd_user_ra_content_t alias { httpd_staff_script_ra_t httpd_sysadm_script_ra_t };
 typealias httpd_user_ra_content_t alias { httpd_auditadm_script_ra_t httpd_secadm_script_ra_t };
@ -5809,7 +5818,7 @@ index 6649962..44258d7 100644
 allow httpd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 allow httpd_t self:fd use;
 allow httpd_t self:sock_file read_sock_file_perms;
-@@ -381,30 +482,39 @@ allow httpd_t self:shm create_shm_perms;
+@@ -381,30 +489,39 @@ allow httpd_t self:shm create_shm_perms;
 allow httpd_t self:sem create_sem_perms;
 allow httpd_t self:msgq create_msgq_perms;
 allow httpd_t self:msg { send receive };
@ -5854,7 +5863,7 @@ index 6649962..44258d7 100644
 logging_log_filetrans(httpd_t, httpd_log_t, file)
 allow httpd_t httpd_modules_t:dir list_dir_perms;
-@@ -412,14 +522,21 @@ mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
+@@ -412,14 +529,21 @@ mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
 read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
 read_lnk_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
@ -5876,7 +5885,7 @@ index 6649962..44258d7 100644
 allow httpd_t httpd_sys_script_t:unix_stream_socket connectto;
 manage_dirs_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
-@@ -450,140 +567,174 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
+@@ -450,140 +574,174 @@ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
 manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
 manage_lnk_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
@ -5944,7 +5953,7 @@ index 6649962..44258d7 100644
 +fs_read_hugetlbfs_files(httpd_t)
 +
 +auth_use_nsswitch(httpd_t)
- 
+
 +application_exec_all(httpd_t)
 +
 +# execute perl
@ -5953,7 +5962,7 @@ index 6649962..44258d7 100644
 +
 +domain_use_interactive_fds(httpd_t)
 +domain_dontaudit_read_all_domains_state(httpd_t)
-+
+ 
 +files_dontaudit_search_all_pids(httpd_t)
 files_dontaudit_getattr_all_pids(httpd_t)
 -files_read_usr_files(httpd_t)
@ -6116,7 +6125,7 @@ index 6649962..44258d7 100644
 ')
 tunable_policy(`httpd_enable_cgi && httpd_use_nfs',`
-@@ -594,28 +745,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',`
+@@ -594,28 +752,50 @@ tunable_policy(`httpd_enable_cgi && httpd_use_cifs',`
 	fs_cifs_domtrans(httpd_t, httpd_sys_script_t)
 ')
@ -6176,7 +6185,7 @@ index 6649962..44258d7 100644
 ')
 tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -624,68 +797,46 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
+@@ -624,68 +804,46 @@ tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
 	fs_read_nfs_symlinks(httpd_t)
 ')
@ -6269,7 +6278,7 @@ index 6649962..44258d7 100644
 ')
 tunable_policy(`httpd_setrlimit',`
-@@ -695,49 +846,48 @@ tunable_policy(`httpd_setrlimit',`
+@@ -695,49 +853,48 @@ tunable_policy(`httpd_setrlimit',`
 tunable_policy(`httpd_ssi_exec',`
 	corecmd_shell_domtrans(httpd_t, httpd_sys_script_t)
@ -6290,17 +6299,17 @@ index 6649962..44258d7 100644
 -	userdom_use_user_terminals(httpd_t)
 -',`
 -	userdom_dontaudit_use_user_terminals(httpd_t)
-')
+	userdom_use_inherited_user_terminals(httpd_t)
-
+	userdom_use_inherited_user_terminals(httpd_suexec_t)
 ')
 -tunable_policy(`httpd_use_cifs',`
 -	fs_list_auto_mountpoints(httpd_t)
 -	fs_manage_cifs_dirs(httpd_t)
 -	fs_manage_cifs_files(httpd_t)
 -	fs_manage_cifs_symlinks(httpd_t)
-+	userdom_use_inherited_user_terminals(httpd_t)
+-')
-+	userdom_use_inherited_user_terminals(httpd_suexec_t)
+-
 ')
 -tunable_policy(`httpd_use_cifs && httpd_builtin_scripting',`
 -	fs_exec_cifs_files(httpd_t)
 -')
@ -6350,7 +6359,7 @@ index 6649962..44258d7 100644
 ')
 optional_policy(`
-@@ -749,24 +899,32 @@ optional_policy(`
+@@ -749,24 +906,32 @@ optional_policy(`
 ')
 optional_policy(`
@ -6389,7 +6398,7 @@ index 6649962..44258d7 100644
 ')
 optional_policy(`
-@@ -775,6 +933,10 @@ optional_policy(`
+@@ -775,6 +940,10 @@ optional_policy(`
 	tunable_policy(`httpd_dbus_avahi',`
 		avahi_dbus_chat(httpd_t)
 	')
@ -6400,7 +6409,7 @@ index 6649962..44258d7 100644
 ')
 optional_policy(`
-@@ -786,35 +948,60 @@ optional_policy(`
+@@ -786,35 +955,60 @@ optional_policy(`
 ')
 optional_policy(`
@ -6474,10 +6483,22 @@ index 6649962..44258d7 100644
 	tunable_policy(`httpd_manage_ipa',`
 		memcached_manage_pid_files(httpd_t)
-@@ -822,8 +1009,18 @@ optional_policy(`
+@@ -822,8 +1016,30 @@ optional_policy(`
 ')
 optional_policy(`
 +    tunable_policy(`httpd_run_ipa',`
 +        oddjob_dbus_chat(httpd_t)
 +    ')
 +')
 +
 +optional_policy(`
 +    tunable_policy(`httpd_run_ipa',`
 +        ipa_domtrans_helper(httpd_t)
 +    ')
 +')
 +
 +optional_policy(`
 +	munin_read_config(httpd_t)
 +')
 +
@ -6493,7 +6514,7 @@ index 6649962..44258d7 100644
 	tunable_policy(`httpd_can_network_connect_db',`
 		mysql_tcp_connect(httpd_t)
-@@ -832,6 +1029,8 @@ optional_policy(`
+@@ -832,6 +1048,8 @@ optional_policy(`
 optional_policy(`
 	nagios_read_config(httpd_t)
@ -6502,7 +6523,7 @@ index 6649962..44258d7 100644
 ')
 optional_policy(`
-@@ -842,20 +1041,40 @@ optional_policy(`
+@@ -842,20 +1060,40 @@ optional_policy(`
 ')
 optional_policy(`
@ -6537,19 +6558,19 @@ index 6649962..44258d7 100644
 -	')
 +optional_policy(`
 +	puppet_read_lib(httpd_t)
 +')
 +
 +optional_policy(`
 +	pwauth_domtrans(httpd_t)
 ')
 optional_policy(`
 -	puppet_read_lib_files(httpd_t)
 +	pwauth_domtrans(httpd_t)
 +')
 +
 +optional_policy(`
 +	rpm_dontaudit_read_db(httpd_t)
 ')
 optional_policy(`
-@@ -863,16 +1082,31 @@ optional_policy(`
+@@ -863,16 +1101,31 @@ optional_policy(`
 ')
 optional_policy(`
@ -6583,7 +6604,7 @@ index 6649962..44258d7 100644
 ')
 optional_policy(`
-@@ -883,65 +1117,189 @@ optional_policy(`
+@@ -883,65 +1136,189 @@ optional_policy(`
 	yam_read_content(httpd_t)
 ')
@ -6672,10 +6693,11 @@ index 6649962..44258d7 100644
 -',`
 -	userdom_dontaudit_use_user_terminals(httpd_helper_t)
 +	userdom_use_inherited_user_terminals(httpd_helper_t)
-+')
+ ')
-+
+ 
-+########################################
+ ########################################
-+#
+ #
 -# Suexec local policy
 +# Apache PHP script local policy
 +#
 +
@ -6734,11 +6756,10 @@ index 6649962..44258d7 100644
 +	tunable_policy(`httpd_can_network_connect_db',`
 +		postgresql_tcp_connect(httpd_php_t)
 +	')
- ')
+')
- 
+
- ########################################
+########################################
- #
+#
 -# Suexec local policy
 +# Apache suexec local policy
 #
@ -6795,7 +6816,7 @@ index 6649962..44258d7 100644
 files_dontaudit_search_pids(httpd_suexec_t)
 files_search_home(httpd_suexec_t)
-@@ -950,123 +1308,74 @@ auth_use_nsswitch(httpd_suexec_t)
+@@ -950,123 +1327,74 @@ auth_use_nsswitch(httpd_suexec_t)
 logging_search_logs(httpd_suexec_t)
 logging_send_syslog_msg(httpd_suexec_t)
@ -6950,7 +6971,7 @@ index 6649962..44258d7 100644
 	mysql_read_config(httpd_suexec_t)
 	tunable_policy(`httpd_can_network_connect_db',`
-@@ -1083,172 +1392,107 @@ optional_policy(`
+@@ -1083,172 +1411,107 @@ optional_policy(`
 	')
 ')
@ -6972,11 +6993,11 @@ index 6649962..44258d7 100644
 -allow httpd_script_domains self:unix_stream_socket connectto;
 -
 -allow httpd_script_domains httpd_sys_content_t:dir search_dir_perms;
-+allow httpd_sys_script_t self:process getsched;
+-
 -append_files_pattern(httpd_script_domains, httpd_log_t, httpd_log_t)
 -read_lnk_files_pattern(httpd_script_domains, httpd_log_t, httpd_log_t)
-
+allow httpd_sys_script_t self:process getsched;
 -kernel_dontaudit_search_sysctl(httpd_script_domains)
 -kernel_dontaudit_search_kernel_sysctl(httpd_script_domains)
 -
@ -7133,7 +7154,8 @@ index 6649962..44258d7 100644
 -kernel_read_kernel_sysctls(httpd_sys_script_t)
 -
 -fs_search_auto_mountpoints(httpd_sys_script_t)
-
+corenet_all_recvfrom_netlabel(httpd_sys_script_t)
 -files_read_var_symlinks(httpd_sys_script_t)
 -files_search_var_lib(httpd_sys_script_t)
 -files_search_spool(httpd_sys_script_t)
@ -7141,8 +7163,7 @@ index 6649962..44258d7 100644
 -apache_domtrans_rotatelogs(httpd_sys_script_t)
 -
 -auth_use_nsswitch(httpd_sys_script_t)
-+corenet_all_recvfrom_netlabel(httpd_sys_script_t)
+-
 -tunable_policy(`httpd_can_sendmail',`
 -	corenet_sendrecv_smtp_client_packets(httpd_sys_script_t)
 -	corenet_tcp_connect_smtp_port(httpd_sys_script_t)
@ -7188,7 +7209,7 @@ index 6649962..44258d7 100644
 ')
 tunable_policy(`httpd_read_user_content',`
-@@ -1256,64 +1500,74 @@ tunable_policy(`httpd_read_user_content',`
+@@ -1256,64 +1519,74 @@ tunable_policy(`httpd_read_user_content',`
 ')
 tunable_policy(`httpd_use_cifs',`
@ -7285,7 +7306,7 @@ index 6649962..44258d7 100644
 ########################################
 #
-@@ -1321,8 +1575,15 @@ miscfiles_read_localization(httpd_rotatelogs_t)
+@@ -1321,8 +1594,15 @@ miscfiles_read_localization(httpd_rotatelogs_t)
 #
 optional_policy(`
@ -7302,7 +7323,7 @@ index 6649962..44258d7 100644
 ')
 ########################################
-@@ -1330,49 +1591,38 @@ optional_policy(`
+@@ -1330,49 +1610,38 @@ optional_policy(`
 # User content local policy
 #
@ -7367,7 +7388,7 @@ index 6649962..44258d7 100644
 kernel_read_system_state(httpd_passwd_t)
 corecmd_exec_bin(httpd_passwd_t)
-@@ -1382,38 +1632,109 @@ dev_read_urand(httpd_passwd_t)
+@@ -1382,38 +1651,109 @@ dev_read_urand(httpd_passwd_t)
 domain_use_interactive_fds(httpd_passwd_t)
@ -25135,10 +25156,10 @@ index 0000000..457d4dd
 +')
 diff --git a/dnssec.te b/dnssec.te
 new file mode 100644
-index 0000000..1e0a31f
+index 0000000..6d795fe
 --- /dev/null
 +++ b/dnssec.te
-@@ -0,0 +1,74 @@
+@@ -0,0 +1,81 @@
 +policy_module(dnssec, 1.0.0)
 +
 +########################################
@ -25156,6 +25177,9 @@ index 0000000..1e0a31f
 +type dnssec_trigger_var_run_t;
 +files_pid_file(dnssec_trigger_var_run_t)
 +
 +type dnssec_trigger_tmp_t;
 +files_tmp_file(dnssec_trigger_tmp_t)
 +
 +########################################
 +#
 +# dnssec_trigger local policy
@ -25171,6 +25195,10 @@ index 0000000..1e0a31f
 +manage_files_pattern(dnssec_trigger_t, dnssec_trigger_var_run_t, dnssec_trigger_var_run_t)
 +files_pid_filetrans(dnssec_trigger_t, dnssec_trigger_var_run_t, { dir file })
 +
 +manage_files_pattern(dnssec_trigger_t,dnssec_trigger_tmp_t,dnssec_trigger_tmp_t)
 +manage_dirs_pattern(dnssec_trigger_t,dnssec_trigger_tmp_t,dnssec_trigger_tmp_t)
 +files_tmp_filetrans(dnssec_trigger_t,dnssec_trigger_tmp_t,{ file dir })
 +
 +kernel_read_system_state(dnssec_trigger_t)
 +
 +corecmd_exec_bin(dnssec_trigger_t)
@ -28721,7 +28749,7 @@ index 4498143..84a4858 100644
 	ftp_run_ftpdctl($1, $2)
 ')
 diff --git a/ftp.te b/ftp.te
-index 36838c2..a422d04 100644
+index 36838c2..a09e8b2 100644
 --- a/ftp.te
 +++ b/ftp.te
@@ -13,7 +13,7 @@ policy_module(ftp, 1.15.1)
@ -28767,22 +28795,7 @@ index 36838c2..a422d04 100644
 ## <desc>
 ##	<p>
-@@ -50,14 +57,6 @@ gen_tunable(ftpd_connect_db, false)
+@@ -124,6 +131,9 @@ files_config_file(ftpd_etc_t)
 ## <desc>
 ##	<p>
 -##	Determine whether ftpd can bind to all
 -##	unreserved ports for passive mode.
 -##	</p>
 -##	</desc>
 -gen_tunable(ftpd_use_passive_mode, false)
 -
 -## <desc>
 -##	<p>
 ##	Determine whether ftpd can connect to
 ##	all unreserved ports.
 ##	</p>
@@ -124,6 +123,9 @@ files_config_file(ftpd_etc_t)
 type ftpd_initrc_exec_t;
 init_script_file(ftpd_initrc_exec_t)
@ -28792,7 +28805,7 @@ index 36838c2..a422d04 100644
 type ftpd_keytab_t;
 files_type(ftpd_keytab_t)
-@@ -184,6 +186,9 @@ allow ftpd_t ftpd_keytab_t:file read_file_perms;
+@@ -184,6 +194,9 @@ allow ftpd_t ftpd_keytab_t:file read_file_perms;
 allow ftpd_t ftpd_lock_t:file manage_file_perms;
 files_lock_filetrans(ftpd_t, ftpd_lock_t, file)
@ -28802,7 +28815,7 @@ index 36838c2..a422d04 100644
 manage_dirs_pattern(ftpd_t, ftpd_tmpfs_t, ftpd_tmpfs_t)
 manage_files_pattern(ftpd_t, ftpd_tmpfs_t, ftpd_tmpfs_t)
 manage_lnk_files_pattern(ftpd_t, ftpd_tmpfs_t, ftpd_tmpfs_t)
-@@ -198,22 +203,19 @@ files_pid_filetrans(ftpd_t, ftpd_var_run_t, { file dir })
+@@ -198,22 +211,19 @@ files_pid_filetrans(ftpd_t, ftpd_var_run_t, { file dir })
 allow ftpd_t ftpdctl_tmp_t:sock_file delete_sock_file_perms;
@ -28829,7 +28842,7 @@ index 36838c2..a422d04 100644
 corenet_all_recvfrom_netlabel(ftpd_t)
 corenet_tcp_sendrecv_generic_if(ftpd_t)
 corenet_udp_sendrecv_generic_if(ftpd_t)
-@@ -229,9 +231,12 @@ corenet_tcp_bind_ftp_port(ftpd_t)
+@@ -229,9 +239,12 @@ corenet_tcp_bind_ftp_port(ftpd_t)
 corenet_sendrecv_ftp_data_server_packets(ftpd_t)
 corenet_tcp_bind_ftp_data_port(ftpd_t)
@ -28843,7 +28856,7 @@ index 36838c2..a422d04 100644
 files_read_etc_runtime_files(ftpd_t)
 files_search_var_lib(ftpd_t)
-@@ -250,7 +255,6 @@ logging_send_audit_msgs(ftpd_t)
+@@ -250,7 +263,6 @@ logging_send_audit_msgs(ftpd_t)
 logging_send_syslog_msg(ftpd_t)
 logging_set_loginuid(ftpd_t)
@ -28851,7 +28864,7 @@ index 36838c2..a422d04 100644
 miscfiles_read_public_files(ftpd_t)
 seutil_dontaudit_search_config(ftpd_t)
-@@ -259,37 +263,47 @@ sysnet_use_ldap(ftpd_t)
+@@ -259,32 +271,50 @@ sysnet_use_ldap(ftpd_t)
 userdom_dontaudit_use_unpriv_user_fds(ftpd_t)
 userdom_dontaudit_search_user_home_dirs(ftpd_t)
@ -28898,18 +28911,18 @@ index 36838c2..a422d04 100644
 -	files_manage_non_auth_files(ftpd_t)
 +	files_manage_non_security_dirs(ftpd_t)
 +	files_manage_non_security_files(ftpd_t)
- ')
+')
- 
+
-tunable_policy(`ftpd_use_passive_mode',`
+tunable_policy(`ftpd_use_passive_mode',`
-	corenet_sendrecv_all_server_packets(ftpd_t)
+	corenet_tcp_bind_all_unreserved_ports(ftpd_t)
-	corenet_tcp_bind_all_unreserved_ports(ftpd_t)
+')
 +
 +tunable_policy(`ftpd_connect_all_unreserved',`
 +	corenet_tcp_connect_all_unreserved_ports(ftpd_t)
 ')
- tunable_policy(`ftpd_connect_all_unreserved',`
+ tunable_policy(`ftpd_use_passive_mode',`
-@@ -304,22 +318,19 @@ tunable_policy(`ftpd_connect_db',`
+@@ -304,22 +334,19 @@ tunable_policy(`ftpd_connect_db',`
 	corenet_sendrecv_mssql_client_packets(ftpd_t)
 	corenet_tcp_connect_mssql_port(ftpd_t)
 	corenet_tcp_sendrecv_mssql_port(ftpd_t)
@ -28937,7 +28950,7 @@ index 36838c2..a422d04 100644
 	userdom_tmp_filetrans_user_tmp(ftpd_t, { dir file })
 ')
-@@ -363,9 +374,8 @@ optional_policy(`
+@@ -363,9 +390,8 @@ optional_policy(`
 optional_policy(`
 	selinux_validate_context(ftpd_t)
@ -28948,7 +28961,7 @@ index 36838c2..a422d04 100644
 	kerberos_use(ftpd_t)
 ')
-@@ -416,21 +426,20 @@ optional_policy(`
+@@ -416,21 +442,20 @@ optional_policy(`
 #
 stream_connect_pattern(ftpdctl_t, ftpd_var_run_t, ftpd_var_run_t, ftpd_t)
@ -28972,7 +28985,7 @@ index 36838c2..a422d04 100644
 miscfiles_read_public_files(anon_sftpd_t)
-@@ -443,23 +452,34 @@ tunable_policy(`sftpd_anon_write',`
+@@ -443,23 +468,34 @@ tunable_policy(`sftpd_anon_write',`
 # Sftpd local policy
 #
@ -29013,7 +29026,7 @@ index 36838c2..a422d04 100644
 ')
 tunable_policy(`sftpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -481,21 +501,11 @@ tunable_policy(`sftpd_anon_write',`
+@@ -481,21 +517,11 @@ tunable_policy(`sftpd_anon_write',`
 tunable_policy(`sftpd_full_access',`
 	allow sftpd_t self:capability { dac_override dac_read_search };
 	fs_read_noxattr_fs_files(sftpd_t)
@ -36212,24 +36225,26 @@ index 0000000..61f2003
 +userdom_use_user_terminals(iotop_t)
 diff --git a/ipa.fc b/ipa.fc
 new file mode 100644
-index 0000000..877a747
+index 0000000..db194ec
 --- /dev/null
 +++ b/ipa.fc
-@@ -0,0 +1,8 @@
+@@ -0,0 +1,10 @@
 +/usr/lib/systemd/system/ipa-otpd.*		--	gen_context(system_u:object_r:ipa_otpd_unit_file_t,s0)
 +
 +/usr/libexec/ipa-otpd		--	gen_context(system_u:object_r:ipa_otpd_exec_t,s0)
 +
 +/usr/libexec/ipa/com\.redhat\.idm\.trust-fetch-domains --   gen_context(system_u:object_r:ipa_helper_exec_t,s0)
 +
 +/var/lib/ipa(/.*)?              gen_context(system_u:object_r:ipa_var_lib_t,s0)
 +
 +/var/run/ipa(/.*)?              gen_context(system_u:object_r:ipa_var_run_t,s0)
 +
 diff --git a/ipa.if b/ipa.if
 new file mode 100644
-index 0000000..789b3e8
+index 0000000..de83173
 --- /dev/null
 +++ b/ipa.if
-@@ -0,0 +1,112 @@
+@@ -0,0 +1,150 @@
 +## <summary>Policy for IPA services.</summary>
 +
 +########################################
@ -36270,6 +36285,44 @@ index 0000000..789b3e8
 +
 +########################################
 +## <summary>
 +##	Execute ipa-helper in the ipa_helper domain.
 +## </summary>
 +## <param name="domain">
 +## <summary>
 +##	Domain allowed to transition.
 +## </summary>
 +## </param>
 +#
 +interface(`ipa_domtrans_helper',`
 +	gen_require(`
 +		type ipa_helper_t, ipa_helper_exec_t;
 +	')
 +
 +	domtrans_pattern($1, ipa_helper_exec_t, ipa_helper_t)
 +')
 +
 +########################################
 +## <summary>
 +##	Execute ipa-helper in the ipa_helper domain.
 +## </summary>
 +## <param name="domain">
 +## <summary>
 +##	Domain allowed to transition.
 +## </summary>
 +## </param>
 +#
 +interface(`ipa_run_helper',`
 +	gen_require(`
 +		type ipa_helper_t;
 +        attribute_role ipa_helper_roles;
 +	')
 +
 +    ipa_domtrans_helper($1)
 +    roleattribute $2 ipa_helper_roles;
 +')
 +
 +########################################
 +## <summary>
 +##	Allow domain to manage ipa lib files/dirs.
 +## </summary>
 +## <param name="domain">
@ -36344,10 +36397,10 @@ index 0000000..789b3e8
 +
 diff --git a/ipa.te b/ipa.te
 new file mode 100644
-index 0000000..a7f09d25
+index 0000000..7d70dcb
 --- /dev/null
 +++ b/ipa.te
-@@ -0,0 +1,50 @@
+@@ -0,0 +1,113 @@
 +policy_module(ipa, 1.0.0)
 +
 +########################################
@ -36357,6 +36410,9 @@ index 0000000..a7f09d25
 +
 +attribute ipa_domain;
 +
 +attribute_role ipa_helper_roles;
 +roleattribute system_r ipa_helper_roles;
 +
 +type ipa_otpd_t, ipa_domain;
 +type ipa_otpd_exec_t;
 +init_daemon_domain(ipa_otpd_t, ipa_otpd_exec_t)
@ -36370,6 +36426,13 @@ index 0000000..a7f09d25
 +type ipa_var_run_t;
 +files_pid_file(ipa_var_run_t)
 +
 +type ipa_helper_t;
 +type ipa_helper_exec_t;
 +domain_type(ipa_helper_t)
 +domain_obj_id_change_exemption(ipa_helper_t)
 +init_system_domain(ipa_helper_t, ipa_helper_exec_t)
 +role ipa_helper_roles types ipa_helper_t;
 +
 +########################################
 +#
 +# ipa_otpd local policy
@ -36398,6 +36461,59 @@ index 0000000..a7f09d25
 +optional_policy(`
 +	kerberos_use(ipa_otpd_t)
 +')
 +
 +########################################
 +#
 +# ipa-helper local policy
 +#
 +
 +
 +allow ipa_helper_t self:capability { dac_override chown };
 +
 +allow ipa_helper_t self:process setfscreate;
 +allow ipa_helper_t self:fifo_file rw_fifo_file_perms;
 +allow ipa_helper_t self:netlink_route_socket r_netlink_socket_perms;
 +
 +kernel_read_system_state(ipa_helper_t)
 +
 +corenet_tcp_connect_ldap_port(ipa_helper_t)
 +corenet_tcp_connect_smbd_port(ipa_helper_t)
 +
 +corecmd_exec_bin(ipa_helper_t)
 +corecmd_exec_shell(ipa_helper_t)
 +
 +dev_read_urand(ipa_helper_t)
 +
 +auth_use_nsswitch(ipa_helper_t)
 +
 +ipa_manage_pid_files(ipa_helper_t)
 +ipa_read_lib(ipa_helper_t)
 +
 +logging_send_syslog_msg(ipa_helper_t)
 +
 +optional_policy(`
 +    ldap_stream_connect(ipa_helper_t)
 +')
 +
 +optional_policy(`
 +    libs_exec_ldconfig(ipa_helper_t)
 +')
 +
 +optional_policy(`
 +    memcached_stream_connect(ipa_helper_t)
 +')
 +
 +optional_policy(`
 +    oddjob_system_entry(ipa_helper_t, ipa_helper_exec_t)
 +')
 +
 +optional_policy(`
 +    samba_read_config(ipa_helper_t)
 +')
 +
 +optional_policy(`
 +    sssd_manage_lib_files(ipa_helper_t)
 +')
 diff --git a/irc.fc b/irc.fc
 index 48e7739..1bf0326 100644
 --- a/irc.fc
@ -50280,7 +50396,7 @@ index f42896c..bd1eb52 100644
 +/var/spool/mail(/.*)?		gen_context(system_u:object_r:mail_spool_t,s0)
 +/var/spool/smtpd(/.*)?		gen_context(system_u:object_r:mail_spool_t,s0)
 diff --git a/mta.if b/mta.if
-index ed81cac..80e6086 100644
+index ed81cac..ad452db 100644
 --- a/mta.if
 +++ b/mta.if
@@ -1,4 +1,4 @@
@ -51236,7 +51352,7 @@ index ed81cac..80e6086 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -1081,3 +1067,201 @@ interface(`mta_rw_user_mail_stream_sockets',`
+@@ -1081,3 +1067,204 @@ interface(`mta_rw_user_mail_stream_sockets',`
 	allow $1 user_mail_domain:unix_stream_socket rw_socket_perms;
 ')
@ -51435,6 +51551,9 @@ index ed81cac..80e6086 100644
 +	mta_etc_filetrans_aliases($1, "aliases.db")
 +	mta_etc_filetrans_aliases($1, "aliasesdb-stamp")
 +	mta_etc_filetrans_aliases($1, "__db.aliases.db")
 +    mta_etc_filetrans_aliases($1, "virtusertable.db")
 +    mta_etc_filetrans_aliases($1, "access.db")
 +    mta_etc_filetrans_aliases($1, "domaintable.db")
 +	mta_filetrans_home_content($1)
 +	mta_filetrans_admin_home_content($1)
 +')
@ -54225,7 +54344,7 @@ index d78dfc3..40e1c77 100644
 -/var/spool/nagios(/.*)?	gen_context(system_u:object_r:nagios_spool_t,s0)
 diff --git a/nagios.if b/nagios.if
-index 0641e97..ed3394e 100644
+index 0641e97..438eeb3 100644
 --- a/nagios.if
 +++ b/nagios.if
@@ -1,12 +1,13 @@
@ -54247,7 +54366,7 @@ index 0641e97..ed3394e 100644
 ##	</summary>
 ## </param>
 #
-@@ -16,38 +17,31 @@ template(`nagios_plugin_template',`
+@@ -16,38 +17,51 @@ template(`nagios_plugin_template',`
 		type nagios_t, nrpe_t;
 	')
@ -54280,6 +54399,26 @@ index 0641e97..ed3394e 100644
 ## <summary>
 -##	Do not audit attempts to read or
 -##	write nagios unnamed pipes.
 +## Execute the nagios unconfined plugins with
 +## a domain transition.
 +## </summary>
 +## <param name="domain">
 +## <summary>
 +## Domain allowed access.
 +## </summary>
 +## </param>
 +#
 +interface(`nagios_domtrans_unconfined_plugins',`
 +   gen_require(`
 +        type nagios_unconfined_plugin_t;
 +        type nagios_unconfined_plugin_exec_t;
 +   ')
 +
 +    domtrans_pattern($1, nagios_unconfined_plugin_exec_t, nagios_unconfined_plugin_t)
 +')
 +
 +########################################
 +## <summary>
 +##	Do not audit attempts to read or write nagios
 +##	unnamed pipes.
 ## </summary>
@ -54292,7 +54431,7 @@ index 0641e97..ed3394e 100644
 #
 interface(`nagios_dontaudit_rw_pipes',`
 	gen_require(`
-@@ -59,7 +53,8 @@ interface(`nagios_dontaudit_rw_pipes',`
+@@ -59,7 +73,8 @@ interface(`nagios_dontaudit_rw_pipes',`
 ########################################
 ## <summary>
@ -54302,7 +54441,7 @@ index 0641e97..ed3394e 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -73,15 +68,33 @@ interface(`nagios_read_config',`
+@@ -73,15 +88,33 @@ interface(`nagios_read_config',`
 		type nagios_etc_t;
 	')
@ -54339,7 +54478,7 @@ index 0641e97..ed3394e 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -100,8 +113,7 @@ interface(`nagios_read_log',`
+@@ -100,8 +133,7 @@ interface(`nagios_read_log',`
 ########################################
 ## <summary>
@ -54349,18 +54488,17 @@ index 0641e97..ed3394e 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -132,13 +144,33 @@ interface(`nagios_search_spool',`
+@@ -132,13 +164,33 @@ interface(`nagios_search_spool',`
 		type nagios_spool_t;
 	')
 -	files_search_spool($1)
 	allow $1 nagios_spool_t:dir search_dir_perms;
 +	files_search_spool($1)
- ')
+')
- 
+
- ########################################
+########################################
- ## <summary>
+## <summary>
 -##	Read nagios temporary files.
 +##	Append nagios spool files.
 +## </summary>
 +## <param name="domain">
@ -54376,16 +54514,17 @@ index 0641e97..ed3394e 100644
 +
 +	allow $1 nagios_spool_t:file append_file_perms;
 +	files_search_spool($1)
-+')
+ ')
-+
+ 
-+########################################
+ ########################################
-+## <summary>
+ ## <summary>
 -##	Read nagios temporary files.
 +##	Allow the specified domain to read
 +##	nagios temporary files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -151,13 +183,34 @@ interface(`nagios_read_tmp_files',`
+@@ -151,13 +203,34 @@ interface(`nagios_read_tmp_files',`
 		type nagios_tmp_t;
 	')
@ -54422,7 +54561,7 @@ index 0641e97..ed3394e 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -170,14 +223,13 @@ interface(`nagios_domtrans_nrpe',`
+@@ -170,14 +243,13 @@ interface(`nagios_domtrans_nrpe',`
 		type nrpe_t, nrpe_exec_t;
 	')
@ -54439,7 +54578,7 @@ index 0641e97..ed3394e 100644
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-@@ -186,44 +238,43 @@ interface(`nagios_domtrans_nrpe',`
+@@ -186,44 +258,43 @@ interface(`nagios_domtrans_nrpe',`
 ## </param>
 ## <param name="role">
 ##	<summary>
@ -64947,10 +65086,10 @@ index 0000000..80246e6
 +
 diff --git a/pcp.te b/pcp.te
 new file mode 100644
-index 0000000..7a3dc05
+index 0000000..15702ce
 --- /dev/null
 +++ b/pcp.te
-@@ -0,0 +1,240 @@
+@@ -0,0 +1,241 @@
 +policy_module(pcp, 1.0.0)
 +
 +########################################
@ -65000,6 +65139,7 @@ index 0000000..7a3dc05
 +allow pcp_domain self:tcp_socket create_stream_socket_perms;
 +allow pcp_domain self:udp_socket create_socket_perms;
 +allow pcp_domain self:netlink_route_socket create_socket_perms;
 +allow pcp_domain self:unix_stream_socket connectto;
 +
 +corenet_tcp_connect_all_ephemeral_ports(pcp_domain)
 +
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 134%{?dist}
+Release: 135%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@ -602,6 +602,30 @@ SELinux Reference policy mls base module.
 %endif
 %changelog
 * Thu Jul 09 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-135
 - Update mta_filetrans_named_content() interface to cover more db files.
 - Revert "Remove ftpd_use_passive_mode boolean. It does not make sense due to ephemeral port handling."
 - Allow pcp domains to connect to own process using unix_stream_socket.
 - Typo in abrt.te
 - Allow  abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly.
 - Add nagios_domtrans_unconfined_plugins() interface.
 - Add nagios_domtrans_unconfined_plugins() interface.
 - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
 - Add support for oddjob based helper in FreeIPA. BZ(1238165)
 - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/ BZ(1240840)
 - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. BZ(1224879)
 - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission.
 - Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires "entrypoint" permissios on nfs_t, cifs_t and fusefs_t SELinux types.
 - nrpe needs kill capability to make gluster moniterd nodes working.
 - Revert "Dontaudit ctbd_t sending signull to smbd_t."
 - Fix interface corenet_tcp_connect_postgresql_port_port(prosody_t)
 - Allow prosody connect to postgresql port.
 - Fix logging_syslogd_run_nagios_plugins calling in logging.te
 - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins.
 - Add support for oddjob based helper in FreeIPA. BZ(1238165)
 - Add new interfaces
 - Add fs_fusefs_entry_type() interface.
 * Thu Jul 02 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-134
 - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. BZ(1224879)
 - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission.